Originally published as part of VerifyClaw's internal security research into LLM-facing attack surfaces — adapted here for a general audience.
An LLM has no hard line between "instructions" and "data" — both arrive as the same stream of tokens. Instruction injection exploits exactly that: an attacker plants an instruction-shaped passage inside material the model is supposed to treat as inert — a tool result, a retrieved document, a skill's own README — and hopes the model follows it instead of (or alongside) the legitimate task.
Why it matters for MCP agents
Any agent that reads external content — a web page, a file, a tool's output, another skill's instructions — has a place where this can happen. The attack doesn't need a jailbreak or a clever encoding; it just needs the model to lose track of who said something in favor of what was said. Because the injected text and the real task instructions look identical at the token level, keyword-matching alone will miss anything that doesn't use an obviously suspicious phrase.
How we study it
Our internal research uses controlled, paired-prompt experiments: render the same legitimate task twice, once with an ordinary data passage and once with an instruction-shaped replacement, and compare what changed — attention mass on the suspicious region, the logits at the decision point, and the actual generated continuation. That kind of controlled A/B comparison is a research method for characterizing model behavior, not a shipped detector — but it's exactly the failure mode our production scanner's 25-pattern grammar scan and deep semantic analysis are built to catch on real submitted skills, by looking for the shape of an embedded directive rather than a specific keyword.
Related reading
- Why Trusted Authors Are Not Safe Code
- How We Test MCP Servers with 86 Attack Techniques
- Jumping the Sandbox Without Touching It (podcast)
VerifyClaw's free grammar scan flags instruction-shaped language inside a SKILL.md in under a second — no payment, no signup.